// ---------------------------------------------------------------------------// HTTP API middleware tags — pure tag definitions, no server dependencies.// Live implementations are in ./middleware-live.ts to keep the WorkOS SDK// out of the client bundle (this file is imported by `auth/api.ts` which// the SPA pulls in for typed schemas).// --------------------------------------------------------------------------- import { Context, Schema } from "effect";import { HttpApiMiddleware, HttpApiSchema, HttpApiSecurity } from "@effect/platform"; // ---------------------------------------------------------------------------// Session — what every authenticated request gets// --------------------------------------------------------------------------- export type Session = {  readonly accountId: string;  readonly email: string;  readonly name: string | null;  readonly avatarUrl: string | null;  /** May be null if the user hasn't joined an organization yet. */  readonly organizationId: string | null;  readonly sealedSession: string;  readonly refreshedSession: string | null;}; export class SessionContext extends Context.Tag("@executor/cloud/Session")<  SessionContext,  Session>() {} // ---------------------------------------------------------------------------// Errors// --------------------------------------------------------------------------- export class Unauthorized extends Schema.TaggedError<Unauthorized>()(  "Unauthorized",  {},  HttpApiSchema.annotations({ status: 401 }),) {} export class NoOrganization extends Schema.TaggedError<NoOrganization>()(  "NoOrganization",  {},  HttpApiSchema.annotations({ status: 403 }),) {} // ---------------------------------------------------------------------------// SessionAuth — resolves the WorkOS session cookie, provides SessionContext// --------------------------------------------------------------------------- export class SessionAuth extends HttpApiMiddleware.Tag<SessionAuth>()("SessionAuth", {  failure: Unauthorized,  provides: SessionContext,  security: {    cookie: HttpApiSecurity.apiKey({ in: "cookie", key: "wos-session" }),  },}) {} // ---------------------------------------------------------------------------// OrgAuth — like SessionAuth but rejects sessions with no organization// --------------------------------------------------------------------------- export class AuthContext extends Context.Tag("@executor/cloud/AuthContext")<  AuthContext,  {    readonly accountId: string;    readonly organizationId: string;    readonly email: string;    readonly name: string | null;    readonly avatarUrl: string | null;  }>() {} export class OrgAuth extends HttpApiMiddleware.Tag<OrgAuth>()("OrgAuth", {  failure: Schema.Union(Unauthorized, NoOrganization),  provides: AuthContext,  security: {    cookie: HttpApiSecurity.apiKey({ in: "cookie", key: "wos-session" }),  },}) {}